CVE-2025-12446: Google Chrome UI Spoofing Vulnerability

CVE-2025-12446 Overview

CVE-2025-12446 is a user interface spoofing vulnerability in the SplitView feature of Google Chrome versions prior to 142.0.7444.59. A remote attacker who convinces a user to perform specific UI gestures can spoof security-relevant interface elements using a crafted domain name. The flaw is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information and was addressed in the Chrome Stable channel update released on October 28, 2025. Google classified the underlying Chromium security severity as Low, and no public exploit or in-the-wild abuse has been reported.

Critical Impact
Attackers can misrepresent the origin of web content in Chrome's SplitView, enabling phishing and credential theft against users tricked into performing specific browser gestures.

Affected Products

Google Chrome prior to 142.0.7444.59 on Microsoft Windows
Google Chrome prior to 142.0.7444.59 on Apple macOS
Google Chrome prior to 142.0.7444.59 on Linux

Discovery Timeline

October 28, 2025 - Google releases patched Chrome Stable channel build 142.0.7444.59
November 10, 2025 - CVE-2025-12446 published to the National Vulnerability Database
June 17, 2026 - Last updated in the NVD database

Technical Details for CVE-2025-12446

Vulnerability Analysis

The vulnerability resides in Chrome's SplitView feature, which renders two browser panes side by side within a single window. Chrome's security UI, including the omnibox origin indicator, must unambiguously bind each rendered page to its true origin. In vulnerable builds, the SplitView code path fails to correctly convey origin information when a crafted domain name is loaded alongside a legitimate site. An attacker exploits this weakness to make one pane appear to represent a trusted origin while actually displaying attacker-controlled content.

Exploitation requires user interaction. The advisory notes that the victim must be convinced to perform specific UI gestures, such as opening a link in SplitView or arranging panes in a particular sequence. Once these conditions are met, the browser presents misleading security indicators that a reasonable user would interpret as evidence of authenticity.

Root Cause

The root cause is incorrect handling of security UI state during SplitView rendering. Origin display logic does not fully account for the multi-pane layout, allowing a crafted domain name to be presented in a way that obscures or misrepresents the actual origin. This is a classic [CWE-451] misrepresentation issue rather than a memory safety or code execution flaw.

Attack Vector

An attacker hosts a page under a specially crafted domain and lures a target to load it through a link, redirect, or advertisement. The attacker then guides the user, through social engineering, to open the page in SplitView beside a trusted site. The spoofed indicators are used to harvest credentials, capture session tokens, or induce approval of sensitive actions. Because no memory corruption or code execution occurs, the impact is limited to deception of the end user.

No verified proof-of-concept code has been published. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2025-12446

Indicators of Compromise

Chrome browser processes running versions earlier than 142.0.7444.59 on managed endpoints.
Browser telemetry showing navigations to lookalike or homograph domains loaded within SplitView sessions.
User reports of credential prompts or sensitive workflows initiated from unexpected SplitView layouts.

Detection Strategies

Inventory installed Chrome versions across the fleet using endpoint management or software inventory tools and flag hosts below 142.0.7444.59.
Monitor proxy and DNS logs for punycode or visually similar domains resolved by browser clients.
Correlate user-reported phishing incidents with browser session data to identify SplitView misuse patterns.

Monitoring Recommendations

Ingest Chrome update status and browser telemetry into your SIEM or data lake for continuous version compliance checks.
Alert on repeated navigations from a trusted enterprise application to a lookalike external domain within short time windows.
Track user-agent strings and Chrome major versions on web application access logs to identify unpatched clients touching sensitive systems.

How to Mitigate CVE-2025-12446

Immediate Actions Required

Update Google Chrome to version 142.0.7444.59 or later on all Windows, macOS, and Linux endpoints.
Force a browser relaunch through enterprise policy so pending updates apply immediately.
Verify update status across the fleet and remediate hosts that report older builds.

Patch Information

Google addressed CVE-2025-12446 in the Chrome Stable channel update announced on October 28, 2025. Administrators should reference the Google Chrome Update Announcement for full release notes and platform-specific build numbers. Chrome auto-update delivers the fix on managed devices, but enterprise deployments using pinned versions or offline installers must push the new build manually.

Workarounds

Disable or restrict the SplitView feature through Chrome enterprise policy where the workflow is not required.
Enforce Safe Browsing Enhanced Protection to reduce exposure to crafted domains used in social engineering.
Train users to verify the address bar contents before entering credentials, especially in multi-pane browser layouts.

bash

# Verify Chrome version on Windows
"%ProgramFiles%\Google\Chrome\Application\chrome.exe" --version

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify Chrome version on Linux
google-chrome --version

# Expected output should be 142.0.7444.59 or later